-
Nightly Development Pre-Release
released this
2026-02-16 23:29:53 +08:00 | 0 commits to main since this releaseThis is a development nightly automatic build.
Downloads
-
Nightly Stable Pre-Release
released this
2026-02-05 06:46:41 +08:00 | 0 commits to main since this releaseThis is a stable nightly build.
Downloads
-
Version 7.4 Stable
released this
2026-02-02 03:38:25 +08:00 | 2 commits to main since this releaseThis release introduces OTP Slots 3 and 4, new USB VID/PID official descriptors and bug fixes.
New
- Added support for OTP slots 3 and 4, activated by pressing the BOOTSEL button three or four times.
- Added RTC set/get support, including RTC association with credentials.
- Added vendor commands via CCID.
- Added sanity checks to prevent handling of oversized packets.
- Introduced new USB descriptors allocated to PicoKeys.
- Added transmission of CBOR error codes over CCID.
- Added Rescue support for RP2040.
Enhancements
- Reorganized project tree and build layout, including ESP32 restructuring.
- Upgraded to the new firmware/layout structure.
- Migrated and cleaned up RTC handling across the codebase.
- Added weak init callback.
- Added PHY marker for RP2040 to preserve serial number in BOOTSEL.
- Added 8K binding partition for RP2350.
Fixed
- Fixed CCID maximum packet length handling and interface naming.
- Fixed OATH compatibility with iOS Authenticator (issue #248).
- Fixed SHA-256 alternative implementation.
- Fixed LED default parameters on Pimoroni boards.
- Fixed vendor key device loading.
- Fixed power-cycle behavior, including missing power-cycle logic.
- Fixed incorrect or incomplete interface string handling when not all interfaces are enabled.
Changed
- Updated to new VID:PID assigned to Pico FIDO.
- Removed non-standard MAKE CREDENTIAL step, now handled via the Rescue interface.
- Removed obsolete PHY and MEMORY vendor commands, available through the Rescue applet.
Full Changelog: https://github.com/polhenarejos/pico-fido/compare/v7.2...v7.4
Downloads
-
Version 7.2 Stable
released this
2026-01-08 18:07:09 +08:00 | 23 commits to main since this releaseThis is a minor release focused on improving compatibility with PicoKey App, along with several important bug fixes and small behavioral changes.
New
- Improved compatibility with PicoKey App, enabling more reliable device detection and interaction.
Enhancements
- Improved overall robustness of applet handling and device enumeration.
- Minor internal adjustments to better align with current host-side tooling expectations.
Bug fixes
- Fixed an issue where the Pimoroni LED was not behaving correctly.
- Fixed a bug in applet selection that could lead to incorrect or inconsistent applet activation.
- Fixed an issue with the MSOS/BOS USB descriptor that could cause host-side compatibility problems.
- Fixed a bug storing resident credentials sharing a same prefix userId (#241).
Changed
- The press button functionality is now disabled by default to avoid unintended behavior.
What's Changed
- Remove WindowsClient from imports by @sylvainpelissier in https://github.com/polhenarejos/pico-fido/pull/181
- ESP32 Optimization by @MageDelfador in https://github.com/polhenarejos/pico-fido/pull/193
New Contributors
- @MageDelfador made their first contribution in https://github.com/polhenarejos/pico-fido/pull/193
Full Changelog: https://github.com/polhenarejos/pico-fido/compare/v6.6...v7.2
Downloads
-
Version 7.0 Stable
released this
2025-12-03 23:37:43 +08:00 | 49 commits to main since this releaseThis is a major release that brings support to PicoKey App, adds support to freshly new RP2354 MCU, adds enhancements to rescue interface and bug fixes.
New
- Add reboot bootsel command
- Add read secure boot status
- Add support for reading memory status
- Add support for PHY READ
- Add support for RP2354 (multiple commits)
- Add dummy LED driver for unsupported boards
- Add support for dynamic LED driver
- Add set of secure functions to derive keys using OTP + pico_serial
- Add pico_serial_hash (unique 32-byte source)
- Add OTP chaff to mitigate PVC attacks
- Add hash functions fed from OTP
- Add 4 pseudorandom bytes for RP entities indexing
- Add compatibility for old resident key system
- Add support for Brainpool curves and Ed448
- Add support for dynamic AID
- Add support for hmac-secret-mc extension
- Add support for persistentPinUvAuthToken
- Add support for FIDO 2.2
- Add VendorConfig: PIN POLICY URL
- Add VendorConfig upload EA command to get_info()
- Add enterprise attestation enabling subcommand
- Add other PHY commands to get_info()
- Add memory leak checker
- Add OTP security enhancements
- Add app_exists() to verify AID presence
- Add missing files / missing header
- Add template for pull requests
- Add support for RP2350 (CI/CD)
Enhancements
- Upgrade to mbedtls v3.6.5
- Upgrade tinycbor to 0.6.1 (multiple commits)
- Upgrade tests to python-fido2 v2.0.0
- Use new PIN system: seeded via OTP when available
- Migrate secure key derivation to new unified system
- NK compatibility improvements
- Flash size determined dynamically at runtime
- ESP32 optimization (PR #193, #189)
- Major refactor of resident keys: shorter fixed-length IDs
- Improve compatibility of old vs new resident key system
- Improve VendorConfig handling
- Move PRODUCT definition to its own file
Bug Fixes
- Fix AID selection (supports shorter matching AIDs)
- Fix OATH AID test
- Fix build for ESP32 / ESP / emulation / dependencies
- Fix key generation for RP2040
- Fix curious bug in FIDO+OpenPGP+CCID
- Fix VID/PID PHY read
- Fix spec compliance: vendor commands < 0x8000000000000000
- Fix OTP alignment issues
- Fix uint16 endianness impacting chained RAPDU
- Fix crash when response buffer not 16-bit aligned
- Fix HID processing for CTAP_HID only
- Fix descriptor descriptions with disabled interfaces
- Fix phy_data idVendor/idProduct when unset
- Fix resident key silent authentication
- Fix CMD_CONFIG VendorCmd
- Fix OpenPGP/PIV dynamic detection
- Fix forced 8-digit serial number (#149)
- Fix build regressions across merges
- Remove WindowsClient from imports
- Remove leftover packet-multiple-of-64 workaround (#95)
- Fixed OTP button press (#208)
- Fixed MSOS/BOS descriptor
Changed
- Do not use secboot in PHY
- Do not call pico_sdk_init (later re-added in SDK)
- Relicense to AGPLv3 + introduce Enterprise/Commercial license model
- Migration to new secure key derivation system replacing MKEK
- Move to new PIN format, seeded via OTP
- Update sdkconfig.defaults
- VendorConfig: some VIDs do not support values (#172)
What's Changed
- Remove WindowsClient from imports by @sylvainpelissier in https://github.com/polhenarejos/pico-fido/pull/181
- ESP32 Optimization by @MageDelfador in https://github.com/polhenarejos/pico-fido/pull/193
New Contributors
- @MageDelfador made their first contribution in https://github.com/polhenarejos/pico-fido/pull/193
Full Changelog: https://github.com/polhenarejos/pico-fido/compare/v6.6...v7.0
Downloads
-
Version 6.6 Stable
released this
2025-04-11 00:53:05 +08:00 | 139 commits to main since this releaseThis release brings several bugfixes and refinements for emulation, authentication flow, compatibility, and build automation.
New
- Added support for Require Touch in ChalResp OTP slots.
- Added EDDSA support as a conditional build.
- Added automatic build of EDDSA variants.
- Added pin-to-core only for ESP32-S3 (due to multicore).
- OTP can now flow through the FIDO interface as a report type 3.
- USB descriptors are now created dynamically.
- Added support to enable/disable each USB interface independently based on PHY parameters.
- Added PHY option to enable specific curves (controlled by the app).
- Added
get led modesupport. - Added EDDSA support as a conditional build.
- Added Git auto-pull when switching branches.
Enhancements
- Improved silent authentication with resident keys (new format required).
alwaysUvis now enabled when PIN is set and required.secp256k1is disabled by default for compatibility and only sent if explicitly enabled.- ES256K1 and EDDSA only reported in GetInfo when supported.
- Do not return
epAttunless explicitly true (improves Linux/Firefox compatibility). - Updated build script to include secure boot pkey and auto EDDSA builds.
- Emulation now defines MCU and supports proper builds.
- Commissioner now forwards new values for LED configuration.
- Upgraded swap file handling with dynamic reference tracking.
- Increased
config_seqon swap and update to ensure state tracking. - Restore LED mode after button press.
- Use TLV format for PHY serialization/unserialization.
- Define MCU for emulation builds.
- Always build CCID if defined.
- Only pin to core in ESP32-S3 (multicore).
- Build cyw43 driver with RP2350.
- Upgraded TinyUSB for ESP32.
- Upgraded mbedTLS to v3.6.3 and fixed git submodules.
- Improved LED support for ESP32S3.
- Improved LED configuration values.
Bug Fixes
- Fix silent authentication with resident credentials. Related to #113.
- Fix
CFG_FLAGSupdate when slot isChalResp. Fixes #142. - Fix OTP update when
LT_CHALis enabled. Fixes #141. - Fix EPNUM counting for ESP32 (KB not sent issue). Fixes #130, #138.
- Fix stack overflow in serializing PHY.
- Fix
CONFIG_TOUCHstatus report. - Fix keyboard interface incompatibility when OTP is disabled.
- Fix HMAC-SHA1 calculation. Fixes #127.
- Fix challenge length calculation for LT64.
- Fix OATH Rename validation and error handling for name reuse.
- Fix encoding in GetInfo with variable curves.
- Fix Commissioner parsing with new fields. Fixes #118.
- Fix swap behavior when deleting dynamic files. Fixes #124.
- Fix multiple emulation build issues.
- Fix Pico SDK cyw43 build compatibility with RP2350.
- Fix USB reporting of extensions when not requested or false. Fixes #136.
- Fix build naming and automation.
- Fix EPNUM counting for ESP32 to restore keyboard functionality.
- Fix ESP32 dynamic USB interface handling.
- Fix ESP32 build errors.
- Fix emulation build issues.
- Fix LED driver build for Pimoroni boards.
- Fix autobuild process.
- Zero
CTAP_RESPbuffer before sending.
Full Changelog: Compare v6.4...v6.6
Downloads
-
Version 6.4 Stable
released this
2025-02-19 22:15:51 +08:00 | 213 commits to main since this releaseThis release brings some enhancements and bugfixes.
New
- Added an option to keep LED steady.
- Added support for ESP32-S2.
- Added support for OATH rename.
- Added fastest clock (200 MHz) for RP2040.
- Added support for the following boards: sparkfun_iotnode_lorawan_rp2350, waveshare_pico_cam_a, waveshare_rp2040_ble, waveshare_rp2040_eth, waveshare_rp2040_geek, waveshare_rp2040_matrix, waveshare_rp2040_pizero, waveshare_rp2040_power_management_hat_b, waveshare_rp2040_tiny, waveshare_rp2040_touch_lcd_1.28, waveshare_rp2350_eth, waveshare_rp2350_geek, waveshare_rp2350_lcd_0.96, waveshare_rp2350_lcd_1.28, waveshare_rp2350_one, waveshare_rp2350_plus_4mb, waveshare_rp2350_plus_16mb, waveshare_rp2350_tiny, waveshare_rp2350_touch_lcd_1.28, waveshare_rp2350_zero
Enhancements
- Led blink limits.
- Added support for silent authentication (necessary for PAM).
- Led driver is taken on build.
- Upgrade to Pico SDK 2.1.1.
Bug Fixes
- Fix multiple CCID displayed interfaces in older PCSC versions and Linux.
- Fix USB keyboard descriptor in Windows.
- Fix potential stack overflow on serializing PHY.
- Fix slot deletion.
- Fix OTP command in Linux.
Full Changelog: https://github.com/polhenarejos/pico-fido/compare/v6.2...v6.4
Downloads
-
Version 6.2 Stable
released this
2025-01-15 22:23:38 +08:00 | 234 commits to main since this releaseThis is maintenance release.
New
- Added support for rollback versions in boards with RP2350 MCU.
- Added support for SET_DATA_RET_AND_CLOCK CCID command.
- Added support for variable timeout push button press.
- Added support for variable USB product name.
- Added flash memory statistics display via pico-fido tool.
- Added option to disable power cycle on reset via Commissioner.
- Add support for PIN hash storage and MKEK.
Enhancements
- Increased ESP32 stack size.
- Added support for TinyUSB 0.17 in ESP32 boards.
- Packed structures for less footprint.
- Set ESP32 stack size depending on the number of enabled interfaces.
- Update CCID descriptor to reflect the max USB packet size.
- Reduce data partition to 2K starting at the half of the flash.
- Compute flash memory bounds depending on the partition if available.
Bug fixes
- Fix build for Pico SDK 2.1.0.
- Use customizable LED PIO number in WS2812, Pico and Cyw43 leds.
- Fix credential initialization on register.
- Fix keepalive issue in pure U2F mode.
- Fix NFC references.
- Fix TX/RX buffers to align them with USB buffers and avoid overflows.
- Fix OTP/MKEK secure system.
Full Changelog: https://github.com/polhenarejos/pico-fido/compare/v6.0...v6.2
Downloads
-
Version 6.0 Stable
released this
2024-11-10 08:22:30 +08:00 | 266 commits to main since this releaseRelease Notes
This is a major release that brings multiple improvements. Support for OTP for RP2350 and ESP32-S3 MCUs is added, which is used to store the MKEK for further security. It also enables Secure Boot and Secure Lock optionally. It also brings the new Pico Commissioner to initialize and configure the Pico HSM without external tools, just directly through the browser.
New
- Upgrade Pico Keys SDK to v7.0.
- Add compiler flags for optimized builds in ESP32.
- Add PICO_PRODUCT.
- Add command to reset device via management app.
- Add rescue app to communicate via webUSB.
- Added support to configure LED GPIO, LED brightness, and LED dimming.
- Add support to LED_GPIO and LED_BTNESS vendor options.
- Add support for commissioning.
- Add autobuild for ESP32.
- Add support for dynamic VIDPID via PHY.
- Add OTP support and SHA256 hardware acceleration.
- Add command to enable secure boot and secure lock via rescue.
- Add product and MCU information in rescue mode.
- Add DEV key to OTP.
- Enable OTP to store a permanent secret key.
- Add json file to enable Secure Boot in RP2350.
- Add macro to parse version file and set pico_binary_version accordingly.
- Add new LED module for color control when available.
Enhancements
- Refactor PHY for a more flexible and scalable architecture.
- Always enable WCID interface.
- Compact PHY configuration.
- Improve LED driver support.
- Specify LED driver for each board.
- Let detect macOS target.
- Added flags for secure boot and secure lock in firmware.
- Use internal TRNG of Pico.
- Upgrade to MbedTLS 3.6.1.
Changes
- Rename CCID_ codes to PICOKEY_ for naming consistency.
- Remove Secure Boot build flags, now added to rescue mode.
- No options on secure boot and lock in PHY.
- Move debug to dedicated header.
- Harmonize build workflow with other repositories.
Bug Fixes
- Fix esp32 build with WCID.
- Fix USB initialization for emulation.
- Fix version header.
- Fix nightly build.
- Fix emulation build.
- Fix ESP & emulation build.
- Fix autobuild for ESP32.
- Fix permissions.
- Fix nightly build.
- Fix build for WS2812 boards.
- Fix header in Linux. Fixes #63.
- Fix SSH-keygen creation. Fixes #59.
- Fix ESP32 GPIO LED issue.
- Fix HID report descriptors.
- Fix PHY for LED neopixel.
- Fix USB descriptor when only HID is enabled.
- Fix LED blink on ON/OFF.
- Fix BOOT press with RP2350.
- Fix maxPower and dwProtocols (recover T=0).
- Fix float casting.
- Do not pack file_t to avoid misalignments.
Full Changelog: https://github.com/polhenarejos/pico-fido/compare/v5.12...v6.0
Downloads
-
Version 5.12 Stable
released this
2024-09-02 23:12:53 +08:00 | 318 commits to main since this releaseThis is a release which solves some bugs and adds enhancements.
New
- Add support to ESP32-S3.
- Add support to RP2350 MCU.
- Add support to multiple boards with RP2350.
Enhancements
- Add EF.DIR list AID.
- Emulation uses pthread thread synchronization for a reliable integration.
- CCID interface is better thread synchronized.
- Upgrade to Pico SDK 2.0.
Changes
- Rewritten HID interface to minimize the number of memcpy's. Now, it uses a single internal buffer, which speeds notably the overall performance.
- HID manages thread synchronicity more precisely.
- RP2350 boards use partitions to prevent data space be overwritten by firmware.
- Emulation does not use crt_dbrg since it is not reliable.
Bugfixes
- Fix Windows compatibility.
- Fix potential infinite loop when bad ASN1 is processed.
- Fix idVendor, idProduct allocation for Pico Patcher.
- Fix memory boundary check.
- Fix non-freed context.
- Fix TinyUSB vendor interface numbering.
- Fix thread cancellation in ESP32.
- Fix CBOR encoding.
- Fix OATH selection.
- Fix OTP crash.
- Fix U2F/FIDO app selection.
Full Changelog: https://github.com/polhenarejos/pico-fido/compare/v5.10...v5.12
Downloads